ScotNet DNSBL • Transparency

Transparency snapshot

Back to DNSBL

Active listings

2,627

Live from BIND zone (A + AAAA)

Threat activity (7 days)

Unique suspicious public IPs • 1,233 matched events • 2,837 requests evaluated

Repeat offenders

118

Threatmail: 69 • Apache security: 49

Lifecycle

Active

Pending review: 0 • Expiring ≤7d: 31 • Expired last run: 0

Delisted records

1 in the last 7 days • unique IPs with a recorded delist

Mail feeds

Active

Threatmail: active
User reports: not enabled • last 2026-06-24 09:25 BST

History coverage

69.8%

1,834 of 2,627 live listings have metadata

Last zone update

2026-06-24 09:15 BST

Authoritative BIND zone last modified

Live status, return code and TXT reason are reconciled directly against the BIND zone. An address is marked DELISTED only when a real delist timestamp, counter or audit event exists; otherwise a non-live historical address is OBSERVED. Repeat-offender totals are grouped by the latest sanitised attack source; complete event history is available only through the per-IP JSON feed and delist information. Apache activity cache updated 2026-06-24 09:25 BST.
BIND records: IPv4 A = 2,627 • IPv6 AAAA = 0 • TXT = 2,627 • SOA serial 2026062411.

Listings history

Live BIND entries plus observation and delisting history. Times use UK local GMT/BST.

Search Source Code Rows Clear

Showing 1–4 of 4 matching records.

IP	Status	Code	Reason	Last activity	Sources	Lists / Delists
82.132.216.65	DELISTED	127.0.0.8	Apache security: device_api_probe; 13 evidence item(s); 4 attack session(s)/7d, 4/30d	20 Jun 15:44 BST	Admin apache-security signed-delist	16 / 12
Full evidence / reason Apache security: device_api_probe; 13 evidence item(s); 4 attack session(s)/7d, 4/30d First observed 2026-06-20 07:57:52 BST Last observed 2026-06-20 12:20:41 BST First listed 2026-06-20 08:00:19 BST Last listed 2026-06-20 13:05:20 BST Last delisted 2026-06-20 15:44:39 BST Last expired — Evidence expiry 2026-09-18 12:20:41 BST Confidence 95/100 very-high Sources Admin apache-security signed-delist Return code 127.0.0.8 Lists / Delists 16 / 12 Sanitised history JSON feed
192.3.140.104	DELISTED	127.0.0.4	Apache security: repeated explicit application probes; 2 evidence item(s); 1 attack session(s)/7d, 1/30d	14 Jun 20:16 BST	admin apache-security Rosko	3 / 3
Full evidence / reason Apache security: repeated explicit application probes; 2 evidence item(s); 1 attack session(s)/7d, 1/30d First observed 2026-06-13 15:47:03 BST Last observed 2026-06-13 15:47:03 BST First listed 2026-06-13 15:50:04 BST Last listed 2026-06-13 16:05:06 BST Last delisted 2026-06-14 20:16:44 BST Last expired — Evidence expiry — Confidence — Sources admin apache-security Rosko Return code 127.0.0.4 Lists / Delists 3 / 3 Sanitised history JSON feed
79.79.79.79	DELISTED	127.0.0.2	Threat Prevention test	5 Jun 21:08 BST	Manual-Miko	1 / 1
Full evidence / reason Threat Prevention test First observed 2026-06-05 21:05:23 BST Last observed 2026-06-05 21:08:17 BST First listed 2026-06-05 21:05:23 BST Last listed 2026-06-05 21:05:23 BST Last delisted 2026-06-05 21:08:17 BST Last expired — Evidence expiry — Confidence — Sources Manual-Miko Return code 127.0.0.2 Lists / Delists 1 / 1 Sanitised history JSON feed
45.135.193.131	DELISTED	127.0.0.4	Threat Prevention test	4 Jun 14:31 BST	manual-test	1 / 1
Full evidence / reason Threat Prevention test First observed 2026-03-29 08:44:41 BST Last observed 2026-06-04 14:31:17 BST First listed 2026-06-04 14:25:11 BST Last listed 2026-06-04 14:25:11 BST Last delisted 2026-06-04 14:31:17 BST Last expired — Evidence expiry 2026-04-30 09:25:44 BST Confidence — Sources manual-test Return code 127.0.0.4 Lists / Delists 1 / 1 Sanitised history JSON feed

Lists / Delists shows list_count and delist_count. OBSERVED means the IP exists in history but is not currently in BIND and has no recorded delist event. Trusted addresses in /etc/scotnet/dnsbl-public-hide.txt are omitted from this public history table.